HIGH RHCOS (Node) H1: Crypto Policy P1

Verified Compare Branch Scanned: 2026-01-14

Verified on cnfdt16 OCP 4.22 RHCOS 9.8. E8 PASS. Moderate crypto policy FAIL (expects FIPS, we set DEFAULT:NO-SHA1).

Overview

This remediation configures the system-wide cryptographic policy to disable SHA1, improving the security posture of RHCOS nodes by enforcing stronger cryptographic standards.

Settings

Setting	Value	Description
`crypto-policy`	`DEFAULT:NO-SHA1`	System-wide crypto policy without SHA1

Implementation

The remediation applies a MachineConfig that sets the crypto policy via a systemd unit:

apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
  name: 75-crypto-policy-high
  labels:
    machineconfiguration.openshift.io/role: master
spec:
  config:
    ignition:
      version: 3.2.0
    systemd:
      units:
        - name: configure-crypto-policy.service
          enabled: true
          contents: |
            [Unit]
            Description=Configure System Crypto Policy
            Before=sshd.service
            After=systemd-machine-id-commit.service
            ConditionFirstBoot=no

            [Service]
            Type=oneshot
            ExecStart=/usr/bin/update-crypto-policies --set DEFAULT:NO-SHA1
            RemainAfterExit=yes

            [Install]
            WantedBy=multi-user.target

Compliance Checks Remediated

This group addresses the following compliance checks:

Check	Profile	Description	Docs
`rhcos4-e8-worker-configure-crypto-policy`	E8	Configure system crypto policy (worker)	📖
`rhcos4-e8-master-configure-crypto-policy`	E8	Configure system crypto policy (master)	📖

Source Remediation Files

high/rhcos4-e8-worker-configure-crypto-policy.yaml
high/rhcos4-e8-master-configure-crypto-policy.yaml

Verification

After applying the MachineConfig, verify the crypto policy on a node:

oc debug node/<node-name> -- chroot /host update-crypto-policies --show
# Expected output: DEFAULT:NO-SHA1

Red Hat Crypto Policies Documentation
NIST SP 800-131A Rev 2 - Transitioning cryptographic algorithms

Upstream Proposal

The following changes could eliminate the need for MachineConfig remediation. Items are categorized by recommended scope:

DEFAULT:NO-SHA1 crypto policy RAN Low

openshift/os Crypto policy preset in base image

RHCOS ships DEFAULT policy. E8 requires NO-SHA1 sub-policy. Hardened container hosts should not use SHA1.
Scope: General OCP clusters may need DEFAULT policy for broad TLS compatibility. NO-SHA1 is a hardening choice.

PR History

DEFAULT:NO-SHA1 crypto policy Not Filed blocked

coreos/rhel-coreos-config

RHEL 9 DEFAULT policy already restricts SHA-1 in signatures for TLS, SSH, IKEv2, DNSSEC, Kerberos. Fedora 41 completed full SHA-1 distrust in OpenSSL — will flow to RHEL 10. Forcing NO-SHA1 at base image level risks breaking third-party integrations relying on SHA-1 (Red Hat KB 7088966). Moderate compliance still fails because it expects FIPS, not just NO-SHA1. Crypto policy is a deployment-specific hardening choice, not a base image default.

discussion.fedoraproject.org/t/f41-change-proposal-make-openssl-distrust-sha-1-signatures-by-default-system-wide/119457 access.redhat.com/solutions/7088966 www.redhat.com/en/blog/rhel-security-sha-1-package-signatures-distrusted-rhel-9

All Groups H2 →